How Biometric Data is Protected Under GDPR: A Practical Guide for HR

Biometric data is the most sensitive category of information an HR or IT team will ever put into a workplace system. A password can be reset. A fingerprint cannot. That single fact explains why GDPR treats biometric templates differently from almost everything else you store about an employee, and why "we installed a fingerprint reader" is never just a hardware decision.

This guide walks through what the regulation actually requires when you use biometrics for door access or attendance, and how to design a setup that holds up under a data protection audit.

Why biometric data gets special treatment

GDPR Article 9 classifies biometric data as a "special category" when it is processed to uniquely identify a person. Processing is prohibited by default unless you can rely on one of the listed exceptions. For employers, the realistic candidates are explicit consent, or processing that is necessary for employment, social security or social protection obligations under national law.

Consent is where most organizations get into trouble. Regulators in several EU member states have taken the position that consent given by an employee is rarely "freely given" because of the power imbalance in the employment relationship. If the only way to enter the building or get paid is to enrol a fingerprint, that consent is not valid. Some national authorities have fined employers for exactly this.

The practical takeaway: do not build your legal basis on consent alone, and never make biometric enrolment the only route into the building.

Start with a DPIA, not a purchase order

A Data Protection Impact Assessment is mandatory when processing is likely to result in high risk, and large-scale use of biometric data for identification clearly qualifies. A workable DPIA for a door or attendance system should answer four questions:

• Necessity: Why is biometric identification needed instead of a badge or a mobile credential?
• Proportionality: Is the site's risk profile high enough to justify it (data centre, lab, pharmacy) or is it convenience?
• Alternatives: What non-biometric option is offered, and is it genuinely equal in access and convenience?
• Risk: What happens to the individual if the template is breached?

If the honest answer to the first question is "it was easier than issuing cards", expect the assessment to push you toward a less invasive method.

Templates, not images

How the data is stored matters as much as whether it is stored. A well-designed system never keeps a fingerprint or face image. It converts the capture into a mathematical template at enrolment and discards the raw image. Ask vendors three things:

1. Is the template reversible into a usable image? It should not be.
2. Is the template stored on the device, on a smart card or token the employee carries, or in a central database? Storage on the credential the employee holds is the lowest-risk option because there is no central pool to breach.
3. Is it encrypted at rest and in transit, with keys you control?

Central databases of templates are a high-value target. If you must use one, segment it from your general HR data and restrict access to a very small named group.

Retention and leavers

Storage limitation is one of the most commonly failed principles. Templates and the associated logs must be deleted when the purpose ends, which for biometrics means when the employee leaves or withdraws from the scheme. Build this into your offboarding checklist:

• Delete the biometric template the same day access is revoked.
• Keep attendance records for the period required by labour law, but separate them from the template itself.
• Document retention periods per data type. The template, the entry log and the timesheet each have different justifications and different clocks.

Automating this is far more reliable than relying on a manual ticket to IT. When provisioning and revocation are tied to the HR record, the template disappears when the employment record closes.

Offer a real alternative

To be defensible, employees who decline biometrics need an equivalent option: an RFID badge, an NFC tag, or a credential in Apple Wallet or Google Wallet on their phone. "Equivalent" means the same doors, the same hours, no extra scrutiny and no penalty. Keep the alternative visible in your privacy notice and in the enrolment flow, not hidden behind a request to HR.

Many organizations find that once a wallet credential is available, only a small share of staff need biometrics at all. Reserve them for the doors where the risk assessment genuinely calls for a second factor.

Transparency and employee rights

Your privacy notice must state what is collected, why, the legal basis, the retention period and who receives it. Employees also have the right to access their data, request erasure where no other basis applies, and object. Prepare a standard response process before the first request arrives, and make sure your processor can execute an erasure across the device, the cloud service and any backups within your stated timeframe.

If your provider processes data on your behalf, you need a Data Processing Agreement, clarity on sub-processors, and, where data leaves the EEA, a valid transfer mechanism.

Where access control and attendance meet

One benefit of combining door access with time tracking is data minimization. When a single entry event opens the door and records attendance, you avoid running a second biometric time clock with its own enrolment, its own template store and its own retention problem. TimeClock 365 works this way: the badge, biometric or wallet credential that opens the door also logs the attendance record, so there is one system to assess, one processor to contract with and one place to enforce deletion.

That consolidation also helps with audits. Instead of reconciling door logs against a separate time clock, you produce a single set of records, with role-based access and a full audit trail of who viewed or exported them.

A short checklist

• Identify your Article 9 exception and do not rely on employee consent alone.
• Complete a DPIA before procurement.
• Store templates, never raw images, preferably on the employee's credential.
• Offer an equivalent non-biometric option.
• Automate deletion when employment ends.
• Sign a DPA and verify sub-processors and data location.
• Update the privacy notice and prepare a subject-rights process.

Handled this way, biometrics can be a defensible tool for the small number of places that need them, rather than a liability you carry everywhere.

Ready to see how one credential can open the door and record attendance with less data to protect? Start your free trial of TimeClock 365.